IN
Product
incus
by lxc · last CVE Oct 22, 2026
47
CVEs
0
On KEV
9.9
Max CVSS
9
New 30D
Severity mix
Critical 16High 12Medium 16Low 3
Watch

Add incus to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-41684
6.5
0%
May 7
Incus: Nil Dereferences on Restore via Malformed YAML
Affected: < 7.0.0
CVE-2026-41647
6.5
0%
May 7
Incus: Nil-Pointer Dereference via S3 Bucket Import
Affected: < 7.0.0
CVE-2026-40251
6.5
0%
May 6
Incus out-of-bounds panic in snapshot metadata handling allows denial of service
Affected: < 7.0.0
CVE-2026-40197
6.5
0%
May 6
Incus nil-pointer dereference in custom volume import allows denial of service
Affected: < 7.0.0
CVE-2026-40195
6.5
0%
May 6
Incus nil-pointer dereference in storage bucket import allows denial of service
Affected: < 7.0.0
CVE-2026-33743
6.5
0%
Mar 26
Incus vulnerable to denial of source through crafted bucket backup file
Affected: < 6.23.0
CVE-2026-115373
New
6.3
0%
Oct 22
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}
Affected: before 6.0.7; 6.1.0 before 7.0.2; 7.1.0 before 7.5.0
CVE-2026-115378
New
5.8
0%
Oct 22
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull
Affected: before 6.0.7; 6.1.0 before 7.0.2; 7.1.0 before 7.5.0
CVE-2026-41648
5.0
0%
May 7
Incus: Unbounded YAML Metadata Decode via Parsing
Affected: < 7.0.0
CVE-2026-35527
5.0
0%
May 5
Incus blind SSRF via image import preflight HEAD request
Affected: < 7.0.0
CVE-2026-40243
4.8
0%
May 6
Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation
Affected: < 7.0.0
CVE-2026-33542
4.8
0%
Mar 26
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Affected: < 6.23.0
CVE-2026-47753
4.4
0%
Aug 21
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
Affected: < 7.1.0
CVE-2026-115370
New
4.3
0%
Oct 22
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh
Affected: 6.0.5 before 6.0.7; 6.12.0 before 7.0.2; 7.1.0 before 7.5.0
CVE-2026-62313
4.3
0%
Aug 21
Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
Affected: < 7.3.0
CVE-2026-41685
4.3
0%
May 7
Incus: Unbounded binary import disk exhaustion
Affected: < 7.0.0
Showing 16